@relayflows/sdk 2.0.29 → 2.0.30

package/dist/hosted-extension-isolation.js

@@ -0,0 +1,322 @@
+import { canonicalize } from './canonical.js';
+import { sha256 } from './bundle.js';
+import { validateHostedFlowExtensionManifest } from './hosted-extension-manifest.js';
+import { assertBaseCompatible, assertCompatible, runtimeVersions } from './flow-extension-compat.js';
+import { hostedExtensionDispatchIdentity, } from './flow-extension-loader.js';
+import { assertHostedInstallationAuthority, assertHostedRuntimeAuthority, } from './hosted-extension-runtime.js';
+import { PluginError } from './plugin-manifest.js';
+import { assertHostedPromiseSafety, frozenHostedPromiseValue, } from './hosted-promise-safety.js';
+import { appendIntrinsicArray } from './intrinsic-array.js';
+import { readStoredPluginFiles } from './plugin-store.js';
+import { boundedJsonSnapshot, } from './hosted-extension-protocol.js';
+import { runHostedExtensionSandbox } from './hosted-extension-sandbox.js';
+export { loadHostedExtensionArtifacts, loadHostedExtensionBase, loadHostedExtensionRuntime, } from './hosted-extension-runtime.js';
+const HOSTED_WRITE = 'cloud:babysitter-turn';
+const ARRAY_IS_ARRAY = Array.isArray;
+const BUFFER_TO_STRING = Function.prototype.call.bind(Buffer.prototype.toString);
+const JSON_PARSE = JSON.parse;
+const NUMBER_IS_SAFE_INTEGER = Number.isSafeInteger;
+const OBJECT_HAS_OWN = Object.hasOwn;
+const OBJECT_FREEZE = Object.freeze;
+const OBJECT_GET_OWN_PROPERTY_DESCRIPTOR = Object.getOwnPropertyDescriptor;
+const OBJECT_KEYS = Object.keys;
+const REGEXP_TEST = Function.prototype.call.bind(RegExp.prototype.test);
+const STRING_STARTS_WITH = Function.prototype.call.bind(String.prototype.startsWith);
+const BABYSITTER_REF = 'github:AgentWorkforce/flows@8b33ebab8347514f80d9da5a81206a087f641714#extensions/babysitter';
+const BABYSITTER_DIGEST = 'bdf2187b9a242667d34bbc63e7a744753e146dc8cd6f4047047f2aed28f406ee';
+const BABYSITTER_MANIFEST_SHA256 = '5631a06bbdc8186f4ee0ff955610ead24d001c5197b59fb1fe81fe422c44f226';
+const DELIVERY_ID = /^[A-Za-z0-9_.:-]{1,200}$/;
+const RECEIPT_ID = /^[A-Za-z0-9_.:-]{1,200}$/;
+const OWNER = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+const REPOSITORY = /^[A-Za-z0-9._-]{1,100}$/;
+const HEAD_SHA = /^[a-f0-9]{40}$/;
+const NATIVE_TRIGGERS = [
+    { provider: 'github', event: 'pull_request', actions: ['opened', 'synchronize', 'reopened', 'ready_for_review', 'closed', 'labeled', 'unlabeled'] },
+    { provider: 'github', event: 'pull_request_review', actions: ['submitted', 'dismissed'] },
+    { provider: 'github', event: 'check_run', actions: ['completed'] },
+    { provider: 'github', event: 'issue_comment', actions: ['created'] },
+];
+/**
+ * Execute a capability-only hosted extension in a Linux mount/PID/network/user
+ * namespace. The extension is first imported inside that namespace. It sees
+ * no host workspace, environment credentials, network, child process, MCP,
+ * helpers, harnesses, or base-flow context. The parent exposes exactly one
+ * authenticated capability adapter and passes the original branded dispatch
+ * authority to that adapter out of band.
+ *
+ * This is deliberately not wired into executeAuthoredFlow yet. #549's refusal
+ * remains the rollout gate until the Cloud adapter and independent review land.
+ */
+export async function runHostedCapabilityExtension(options) {
+    assertHostedPromiseSafety('plugin_unsupported');
+    const identity = hostedExtensionDispatchIdentity(options.dispatch);
+    await assertHostedRuntimeAuthority(options.installation, options.base);
+    const { artifact, manifest } = await selectHostedExtensionForRuntime(options.installation, options.base, identity, runtimeVersions());
+    return await runVerifiedNativeExtensionSandbox({
+        ...options,
+        artifact,
+        manifest,
+        beforeLaunch: () => assertHostedRuntimeAuthority(options.installation, options.base),
+    });
+}
+/** @internal Security-harness seam; not exported from the SDK package root. */
+export async function runVerifiedNativeExtensionSandbox(options) {
+    assertHostedPromiseSafety('plugin_unsupported');
+    assertCapabilityOnlyManifest(options.manifest);
+    const identity = hostedExtensionDispatchIdentity(options.dispatch);
+    assertManifestRoutes(options.manifest, identity);
+    const normalizedInput = babysitterInput(options.input, options.dispatch);
+    const versions = runtimeVersions();
+    const authority = OBJECT_FREEZE({
+        dispatch: options.dispatch,
+        extension: OBJECT_FREEZE({
+            name: options.manifest.name,
+            version: options.manifest.version,
+            ref: options.artifact.ref,
+            digest: options.artifact.digest,
+        }),
+    });
+    return await runHostedExtensionSandbox({
+        artifactDirectory: options.artifact.directory,
+        artifactDigest: options.artifact.digest,
+        entry: options.manifest.entry,
+        surfaceVersion: versions.surface,
+        identity,
+        input: normalizedInput,
+        timeoutMs: ownOption(options, 'timeoutMs'),
+        bubblewrapPath: ownOption(options, 'bubblewrapPath'),
+        nodePath: ownOption(options, 'nodePath'),
+        prlimitPath: ownOption(options, 'prlimitPath'),
+        surfaceRoot: ownOption(options, 'surfaceRoot'),
+        beforeLaunch: ownOption(options, 'beforeLaunch'),
+        invoke: async (request) => babysitterReceipt(await options.babysitterTurn.queue(babysitterRequest(request, normalizedInput, options.dispatch), authority)),
+    });
+}
+/** @internal Selection seam used by compatibility/security regression tests. */
+export async function selectHostedExtensionForRuntime(value, base, identity, versions) {
+    assertHostedPromiseSafety('plugin_source_invalid');
+    assertHostedInstallationAuthority(value);
+    if (typeof base !== 'object' || base === null || typeof base.name !== 'string'
+        || (base.version !== undefined && typeof base.version !== 'string')) {
+        throw new PluginError('plugin_incompatible', 'Hosted base identity is malformed.');
+    }
+    const matches = [];
+    for (let index = 0; index < value.artifacts.length; index += 1) {
+        const artifact = value.artifacts[index];
+        const manifest = await verifiedManifest(artifact);
+        assertCompatible(manifest, versions);
+        assertBaseCompatible(manifest, base);
+        if (hostedManifestRoutes(manifest, identity))
+            appendIntrinsicArray(matches, { artifact, manifest });
+    }
+    if (matches.length > 1) {
+        throw new PluginError('plugin_event_ambiguous', `Hosted event matches multiple extension manifests (${manifestNames(matches)}).`);
+    }
+    const selected = matches[0];
+    if (selected === undefined || selected.artifact.ref !== BABYSITTER_REF) {
+        throw new PluginError('plugin_event_unroutable', 'Hosted event does not route to the pinned native Babysitter extension.');
+    }
+    await assertPinnedBabysitter(selected.artifact);
+    assertCapabilityOnlyManifest(selected.manifest);
+    return frozenHostedPromiseValue(selected);
+}
+async function verifiedManifest(artifact) {
+    if (!matches(/^[a-f0-9]{64}$/, artifact.digest) || !matches(/^[a-f0-9]{64}$/, artifact.manifestSha256)) {
+        throw new PluginError('plugin_source_drift', `${artifact.ref}: hosted extension digests are malformed.`);
+    }
+    const stored = await readStoredPluginFiles(artifact.directory, artifact.digest);
+    let bytes;
+    for (let index = 0; index < stored.length; index += 1) {
+        if (stored[index].path === 'flows-plugin.json')
+            bytes = stored[index].data;
+    }
+    if (bytes === undefined) {
+        throw new PluginError('plugin_source_drift', `${artifact.ref}: flows-plugin.json is missing.`);
+    }
+    if (sha256(bytes) !== artifact.manifestSha256) {
+        throw new PluginError('plugin_source_drift', `${artifact.ref}: flows-plugin.json differs from the lockfile's manifest hash.`);
+    }
+    let input;
+    try {
+        input = JSON_PARSE(BUFFER_TO_STRING(bytes, 'utf8'));
+    }
+    catch {
+        throw new PluginError('plugin_manifest_invalid', `${artifact.ref}: flows-plugin.json is not valid JSON.`);
+    }
+    const manifest = validateHostedFlowExtensionManifest(input);
+    if (manifest.name !== artifact.name || manifest.version !== artifact.version) {
+        throw new PluginError('plugin_source_drift', `${artifact.ref}: manifest names ${manifest.name}@${manifest.version}, lockfile has ${artifact.name}@${artifact.version}.`);
+    }
+    return manifest;
+}
+async function assertPinnedBabysitter(artifact) {
+    if (artifact.ref !== BABYSITTER_REF || artifact.name !== 'babysitter' || artifact.version !== '0.2.0'
+        || artifact.digest !== BABYSITTER_DIGEST || artifact.manifestSha256 !== BABYSITTER_MANIFEST_SHA256) {
+        throw new PluginError('plugin_source_invalid', 'Hosted capability isolation accepts only the reviewed native Babysitter artifact.');
+    }
+    const stored = await readStoredPluginFiles(artifact.directory, artifact.digest);
+    for (let index = 0; index < stored.length; index += 1) {
+        const path = stored[index].path;
+        if (path === 'node_modules' || STRING_STARTS_WITH(path, 'node_modules/')) {
+            throw new PluginError('plugin_source_drift', `${artifact.ref}: hosted extensions cannot carry node_modules.`);
+        }
+    }
+}
+function assertCapabilityOnlyManifest(manifest) {
+    const expected = {
+        integrations: ['github'], harnesses: ['codex'], mcp: [], writes: [HOSTED_WRITE],
+        base: [{ name: 'software-factory', version: '*' }],
+        budget: { dollars: 1, wallclock: '5m' },
+        triggers: NATIVE_TRIGGERS,
+    };
+    const actual = {
+        integrations: manifest.permissions.integrations,
+        harnesses: manifest.permissions.harnesses,
+        mcp: manifest.permissions.mcp,
+        writes: manifest.permissions.writes,
+        base: manifest.compat.base,
+        budget: manifest.permissions.budget,
+        triggers: manifest.triggers,
+    };
+    if (canonicalize(actual) !== canonicalize(expected)
+        || manifest.name !== 'babysitter'
+        || manifest.entry !== 'babysitter.flow.ts'
+        || !manifest.extends.handlers || manifest.extends.hooks.length !== 0
+        || manifest.preflight.credentials.length !== 0 || manifest.preflight.servers.length !== 0) {
+        throw new PluginError('plugin_unsupported', `${manifest.name}: hosted capability isolation accepts only the native Babysitter permission profile.`);
+    }
+}
+function assertManifestRoutes(manifest, identity) {
+    if (!hostedManifestRoutes(manifest, identity)) {
+        throw new PluginError('plugin_event_unroutable', `${manifest.name}: hosted event is not declared exactly once.`);
+    }
+}
+/** Generic handlers overlap action-specific deliveries, matching the SDK handler router. */
+export function hostedManifestRoutes(manifest, identity) {
+    for (let triggerIndex = 0; triggerIndex < manifest.triggers.length; triggerIndex += 1) {
+        const trigger = manifest.triggers[triggerIndex];
+        if (trigger.provider !== identity.provider || trigger.event !== identity.event)
+            continue;
+        if (trigger.actions.length === 0)
+            return true;
+        if (identity.action === undefined)
+            continue;
+        for (let actionIndex = 0; actionIndex < trigger.actions.length; actionIndex += 1) {
+            if (trigger.actions[actionIndex] === identity.action)
+                return true;
+        }
+    }
+    return false;
+}
+function babysitterInput(input, dispatch) {
+    const snapshot = boundedJsonSnapshot(input, 'hosted extension input');
+    const top = exactRecord(snapshot, 'Hosted extension input', ['event', 'pullRequest']);
+    const event = exactRecord(top.event, 'Hosted extension event', ['provider', 'eventType', 'deliveryId']);
+    const pullRequest = optionalRecord(top.pullRequest, 'Hosted extension pull request', ['host', 'owner', 'repo', 'number', 'headSha'], ['owner', 'repo', 'number']);
+    if (event.provider !== dispatch.provider || event.eventType !== dispatch.eventType
+        || event.deliveryId !== dispatch.deliveryId || event.provider !== 'github'
+        || typeof event.deliveryId !== 'string' || !matches(DELIVERY_ID, event.deliveryId)
+        || (pullRequest.host !== undefined && pullRequest.host !== 'github')
+        || typeof pullRequest.owner !== 'string' || !matches(OWNER, pullRequest.owner)
+        || typeof pullRequest.repo !== 'string' || !matches(REPOSITORY, pullRequest.repo)
+        || pullRequest.repo === '.' || pullRequest.repo === '..'
+        || typeof pullRequest.number !== 'number' || !NUMBER_IS_SAFE_INTEGER(pullRequest.number) || pullRequest.number <= 0
+        || (pullRequest.headSha !== undefined
+            && (typeof pullRequest.headSha !== 'string' || !matches(HEAD_SHA, pullRequest.headSha)))) {
+        throw new PluginError('plugin_event_unroutable', 'Hosted extension input does not match the verified GitHub delivery.');
+    }
+    return snapshot;
+}
+function babysitterRequest(value, input, dispatch) {
+    const snapshot = boundedJsonSnapshot(value, 'Babysitter capability request');
+    const request = exactRecord(snapshot, 'Babysitter capability request', ['delivery']);
+    const delivery = exactRecord(request.delivery, 'Babysitter delivery', ['deliveryId', 'provider', 'eventType', 'pullRequest']);
+    const pullRequest = exactRecord(delivery.pullRequest, 'Babysitter pull request', ['owner', 'repository', 'number']);
+    const normalized = exactRecord(input, 'Hosted extension input', ['event', 'pullRequest']);
+    const inputPullRequest = record(normalized.pullRequest, 'Hosted extension pull request');
+    if (delivery.deliveryId !== dispatch.deliveryId
+        || typeof delivery.deliveryId !== 'string' || !matches(DELIVERY_ID, delivery.deliveryId)
+        || delivery.provider !== 'github' || delivery.eventType !== dispatch.eventType
+        || typeof pullRequest.owner !== 'string' || !matches(OWNER, pullRequest.owner)
+        || typeof pullRequest.repository !== 'string' || !matches(REPOSITORY, pullRequest.repository)
+        || pullRequest.repository === '.' || pullRequest.repository === '..'
+        || typeof pullRequest.number !== 'number' || !NUMBER_IS_SAFE_INTEGER(pullRequest.number) || pullRequest.number <= 0
+        || pullRequest.owner !== inputPullRequest.owner
+        || pullRequest.repository !== inputPullRequest.repo
+        || pullRequest.number !== inputPullRequest.number) {
+        throw new PluginError('plugin_event_unroutable', 'Babysitter capability request does not match verified delivery input.');
+    }
+    return snapshot;
+}
+function babysitterReceipt(value) {
+    const snapshot = boundedJsonSnapshot(value, 'Babysitter capability receipt');
+    if (typeof snapshot !== 'object' || snapshot === null || ARRAY_IS_ARRAY(snapshot)) {
+        throw new PluginError('plugin_unsupported', 'Babysitter capability returned an invalid receipt.');
+    }
+    const receipt = snapshot;
+    if (!hasExactKeys(receipt, ['receiptId', 'status'])
+        || typeof receipt.receiptId !== 'string' || !matches(RECEIPT_ID, receipt.receiptId)
+        || (receipt.status !== 'queued' && receipt.status !== 'duplicate')) {
+        throw new PluginError('plugin_unsupported', 'Babysitter capability returned an invalid receipt.');
+    }
+    return OBJECT_FREEZE({ receiptId: receipt.receiptId, status: receipt.status });
+}
+function matches(pattern, value) {
+    return REGEXP_TEST(pattern, value);
+}
+function ownOption(options, name) {
+    const descriptor = OBJECT_GET_OWN_PROPERTY_DESCRIPTOR(options, name);
+    return descriptor !== undefined && 'value' in descriptor ? descriptor.value : undefined;
+}
+function record(value, what) {
+    if (typeof value !== 'object' || value === null || ARRAY_IS_ARRAY(value)) {
+        throw new PluginError('plugin_event_unroutable', `${what} must be an object.`);
+    }
+    return value;
+}
+function exactRecord(value, what, keys) {
+    const object = record(value, what);
+    if (!hasExactKeys(object, keys)) {
+        throw new PluginError('plugin_event_unroutable', `${what} has an invalid field set.`);
+    }
+    return object;
+}
+function optionalRecord(value, what, allowed, required) {
+    const object = record(value, what);
+    const actual = OBJECT_KEYS(object);
+    for (let index = 0; index < actual.length; index += 1) {
+        if (!contains(allowed, actual[index])) {
+            throw new PluginError('plugin_event_unroutable', `${what} has an invalid field set.`);
+        }
+    }
+    for (let index = 0; index < required.length; index += 1) {
+        if (!OBJECT_HAS_OWN(object, required[index])) {
+            throw new PluginError('plugin_event_unroutable', `${what} has an invalid field set.`);
+        }
+    }
+    return object;
+}
+function hasExactKeys(value, keys) {
+    if (OBJECT_KEYS(value).length !== keys.length)
+        return false;
+    for (let index = 0; index < keys.length; index += 1) {
+        if (!OBJECT_HAS_OWN(value, keys[index]))
+            return false;
+    }
+    return true;
+}
+function contains(values, expected) {
+    for (let index = 0; index < values.length; index += 1) {
+        if (values[index] === expected)
+            return true;
+    }
+    return false;
+}
+function manifestNames(matches) {
+    let value = '';
+    for (let index = 0; index < matches.length; index += 1) {
+        value += `${index === 0 ? '' : ', '}${matches[index].manifest.name}`;
+    }
+    return value;
+}
+//# sourceMappingURL=hosted-extension-isolation.js.map

package/dist/hosted-extension-isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-extension-isolation.js","sourceRoot":"","sources":["../src/hosted-extension-isolation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,mCAAmC,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACrG,OAAO,EACL,+BAA+B,GAEhC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAI7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EACL,mBAAmB,GAEpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAQvC,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC;AACrC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAGpE,CAAC;AACZ,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC;AAC9B,MAAM,sBAAsB,GAAG,MAAM,CAAC,aAAa,CAAC;AACpD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;AACrC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;AACpC,MAAM,kCAAkC,GAAG,MAAM,CAAC,wBAAwB,CAAC;AAC3E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;AAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAE1D,CAAC;AACb,MAAM,kBAAkB,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAEvE,CAAC;AACb,MAAM,cAAc,GAAG,4FAA4F,CAAC;AACpH,MAAM,iBAAiB,GAAG,kEAAkE,CAAC;AAC7F,MAAM,0BAA0B,GAAG,kEAAkE,CAAC;AACtG,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAC9C,MAAM,KAAK,GAAG,qCAAqC,CAAC;AACpD,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC,MAAM,eAAe,GAAG;IACtB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE;IACnJ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;IACzF,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;IAClE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE;CACrE,CAAC;AAoCF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAkC;IAElC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,+BAA+B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,4BAA4B,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,+BAA+B,CAClE,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,IAAI,EACZ,QAAQ,EACR,eAAe,EAAE,CAClB,CAAC;IACF,OAAO,MAAM,iCAAiC,CAAC;QAC7C,GAAG,OAAO;QACV,QAAQ;QACR,QAAQ;QACR,YAAY,EAAE,GAAG,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC;KACrF,CAAC,CAAC;AACL,CAAC;AAgBD,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAA0C;IAE1C,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;IAChD,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,+BAA+B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,eAAe,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,SAAS,GAA8B,aAAa,CAAC;QACzD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,aAAa,CAAC;YACvB,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAC3B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;YACjC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG;YACzB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;SAChC,CAAC;KACH,CAAC,CAAC;IACH,OAAO,MAAM,yBAAyB,CAAC;QACrC,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;QAC7C,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;QACvC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK;QAC7B,cAAc,EAAE,QAAQ,CAAC,OAAO;QAChC,QAAQ;QACR,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,SAAS,CAAS,OAAO,EAAE,WAAW,CAAC;QAClD,cAAc,EAAE,SAAS,CAAS,OAAO,EAAE,gBAAgB,CAAC;QAC5D,QAAQ,EAAE,SAAS,CAAS,OAAO,EAAE,UAAU,CAAC;QAChD,WAAW,EAAE,SAAS,CAAS,OAAO,EAAE,aAAa,CAAC;QACtD,WAAW,EAAE,SAAS,CAAS,OAAO,EAAE,aAAa,CAAC;QACtD,YAAY,EAAE,SAAS,CAAsB,OAAO,EAAE,cAAc,CAAC;QACrE,MAAM,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAC3E,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,EAC7D,SAAS,CACV,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAkC,EAClC,IAAyB,EACzB,QAAyF,EACzF,QAAoD;IAEpD,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;IACnD,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;WACzE,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,OAAO,GAAkF,EAAE,CAAC;IAClG,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClD,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,oBAAoB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,WAAW,CACnB,wBAAwB,EACxB,sDAAsD,aAAa,CAAC,OAAO,CAAC,IAAI,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,KAAK,cAAc,EAAE,CAAC;QACvE,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,wEAAwE,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAiC;IAC/D,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACvG,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,GAAG,QAAQ,CAAC,GAAG,2CAA2C,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChF,IAAI,KAAyB,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,KAAK,CAAE,CAAC,IAAI,KAAK,mBAAmB;YAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC,IAAI,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,GAAG,QAAQ,CAAC,GAAG,iCAAiC,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC9C,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,GAAG,QAAQ,CAAC,GAAG,gEAAgE,CAAC,CAAC;IAChI,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAC5D,MAAM,CAAC;QAAC,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,GAAG,QAAQ,CAAC,GAAG,wCAAwC,CAAC,CAAC;IAAC,CAAC;IACpH,MAAM,QAAQ,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC7E,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,GAAG,QAAQ,CAAC,GAAG,oBAAoB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,kBAAkB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,GAAG,CAC3H,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,QAAiC;IACrE,IAAI,QAAQ,CAAC,GAAG,KAAK,cAAc,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;WAChG,QAAQ,CAAC,MAAM,KAAK,iBAAiB,IAAI,QAAQ,CAAC,cAAc,KAAK,0BAA0B,EAAE,CAAC;QACrG,MAAM,IAAI,WAAW,CACnB,uBAAuB,EACvB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC,IAAI,CAAC;QACjC,IAAI,IAAI,KAAK,cAAc,IAAI,kBAAkB,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,GAAG,QAAQ,CAAC,GAAG,gDAAgD,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,QAA+B;IACnE,MAAM,QAAQ,GAAG;QACf,YAAY,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC;QAC/E,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAClD,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;QACvC,QAAQ,EAAE,eAAe;KAC1B,CAAC;IACF,MAAM,MAAM,GAAG;QACb,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,YAAY;QAC/C,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,SAAS;QACzC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG;QAC7B,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM;QACnC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI;QAC1B,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM;QACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC;WAC9C,QAAQ,CAAC,IAAI,KAAK,YAAY;WAC9B,QAAQ,CAAC,KAAK,KAAK,oBAAoB;WACvC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;WACjE,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,WAAW,CACnB,oBAAoB,EACpB,GAAG,QAAQ,CAAC,IAAI,sFAAsF,CACvG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAA+B,EAC/B,QAAyF;IAEzF,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,GAAG,QAAQ,CAAC,IAAI,8CAA8C,CAAC,CAAC;IACnH,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAClC,QAAiD,EACjD,QAAyF;IAEzF,KAAK,IAAI,YAAY,GAAG,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,IAAI,CAAC,EAAE,CAAC;QACtF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAE,CAAC;QACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAAE,SAAS;QACzF,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC5C,KAAK,IAAI,WAAW,GAAG,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC;YACjF,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,QAAiC;IACxE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,EAAE,wBAAwB,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,wBAAwB,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IACxG,MAAM,WAAW,GAAG,cAAc,CAChC,GAAG,CAAC,WAAW,EACf,+BAA+B,EAC/B,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAC9C,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAC5B,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;WAC7E,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;WACvE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC;WAC/E,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC;WACjE,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;WAC3E,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC;WAC9E,WAAW,CAAC,IAAI,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,KAAK,IAAI;WACrD,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC;WAChH,CAAC,WAAW,CAAC,OAAO,KAAK,SAAS;eAChC,CAAC,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,qEAAqE,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAc,EAAE,QAAiC;IAC1F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,+BAA+B,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9H,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpH,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,EAAE,wBAAwB,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;IACzF,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;WAC1C,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC;WACrF,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;WAC3E,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;WAC3E,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC;WAC1F,WAAW,CAAC,UAAU,KAAK,GAAG,IAAI,WAAW,CAAC,UAAU,KAAK,IAAI;WACjE,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC;WAChH,WAAW,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK;WAC5C,WAAW,CAAC,UAAU,KAAK,gBAAgB,CAAC,IAAI;WAChD,WAAW,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,uEAAuE,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC7E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,oDAAoD,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,OAAO,GAAG,QAAmC,CAAC;IACpD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;WAC9C,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC;WAChF,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,oDAAoD,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,KAAa;IAC7C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAI,OAAe,EAAE,IAAY;IACjD,MAAM,UAAU,GAAG,kCAAkC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrE,OAAO,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/F,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAY;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,GAAG,IAAI,qBAAqB,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY,EAAE,IAAuB;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,GAAG,IAAI,4BAA4B,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,IAAY,EACZ,OAA0B,EAC1B,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAE,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,GAAG,IAAI,4BAA4B,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,GAAG,IAAI,4BAA4B,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B,EAAE,IAAuB;IAC3E,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAE,CAAC;YAAE,OAAO,KAAK,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,MAAyB,EAAE,QAAgB;IAC3D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CACpB,OAAgE;IAEhE,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/hosted-extension-manifest.d.ts

@@ -0,0 +1,9 @@
+import type { FlowExtensionManifest } from './flow-extension-manifest.js';
+/**
+ * Hosted manifests are parsed after authored code may have executed. Keep this
+ * projection deliberately narrower than the authoring validator and use only
+ * module-captured intrinsics. The only manifest that can launch is separately
+ * pinned by exact ref, payload digest, and manifest digest.
+ */
+export declare function validateHostedFlowExtensionManifest(input: unknown): FlowExtensionManifest;
+//# sourceMappingURL=hosted-extension-manifest.d.ts.map

package/dist/hosted-extension-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-extension-manifest.d.ts","sourceRoot":"","sources":["../src/hosted-extension-manifest.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,qBAAqB,EAGtB,MAAM,8BAA8B,CAAC;AAwCtC;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAgDzF"}

package/dist/hosted-extension-manifest.js

@@ -0,0 +1,235 @@
+import { safePath } from './bundle.js';
+import { snapshotJsonValue } from './json-value.js';
+import { frozenHostedPromiseValue } from './hosted-promise-safety.js';
+import { appendIntrinsicArray } from './intrinsic-array.js';
+import { PluginError } from './plugin-manifest.js';
+const ARRAY_IS_ARRAY = Array.isArray;
+const NUMBER_IS_FINITE = Number.isFinite;
+const OBJECT_CREATE = Object.create;
+const OBJECT_FREEZE = Object.freeze;
+const OBJECT_HAS_OWN = Object.hasOwn;
+const OBJECT_KEYS = Object.keys;
+const REGEXP_TEST = Function.prototype.call.bind(RegExp.prototype.test);
+const STRING_ENDS_WITH = Function.prototype.call.bind(String.prototype.endsWith);
+const STRING_STARTS_WITH = Function.prototype.call.bind(String.prototype.startsWith);
+const STRING_TRIM = Function.prototype.call.bind(String.prototype.trim);
+const TOP_LEVEL = [
+    'schema', 'kind', 'name', 'version', 'description', 'source', 'compat', 'entry',
+    'extends', 'triggers', 'gates', 'verbs', 'permissions', 'preflight', 'config',
+];
+const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const PROVIDER = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const WRITE_CLASS = /^[a-z0-9-]+(?::[a-z0-9_-]+)+$/;
+const WALLCLOCK = /^\d+(?:ms|s|m|h|d)$/;
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+const VERSION_RANGE = /^(?:\*|(?:[\^~]|>=)?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?: <\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)?)$/;
+const MAX_DESCRIPTION = 500;
+const MAX_LIST = 64;
+/**
+ * Hosted manifests are parsed after authored code may have executed. Keep this
+ * projection deliberately narrower than the authoring validator and use only
+ * module-captured intrinsics. The only manifest that can launch is separately
+ * pinned by exact ref, payload digest, and manifest digest.
+ */
+export function validateHostedFlowExtensionManifest(input) {
+    let value;
+    try {
+        value = snapshotJsonValue(input, 'hosted plugin manifest');
+    }
+    catch {
+        return invalid('Hosted plugin manifest must be JSON data.');
+    }
+    if (!record(value) || !hasOnlyKeys(value, TOP_LEVEL))
+        return invalid('Expected a hosted flow-extension manifest object.');
+    if (value.schema !== 2 || value.kind !== 'flow-extension')
+        return invalid('Hosted flow extensions require schema 2.');
+    if (typeof value.name !== 'string' || !matches(NAME, value.name) || STRING_STARTS_WITH(value.name, 'helper-')) {
+        return invalid('name must be lowercase kebab-case and must not start with helper-.');
+    }
+    if (typeof value.version !== 'string' || !matches(VERSION, value.version))
+        return invalid('version must be semver x.y.z.');
+    if (value.description !== undefined
+        && (typeof value.description !== 'string' || value.description.length > MAX_DESCRIPTION)) {
+        return invalid(`description must be a string of at most ${MAX_DESCRIPTION} characters.`);
+    }
+    if (value.source !== undefined || value.config !== undefined) {
+        throw new PluginError('plugin_unsupported', 'Hosted capability extensions cannot declare source or config metadata.');
+    }
+    if (typeof value.entry !== 'string' || !STRING_ENDS_WITH(value.entry, '.flow.ts') || !safePath(value.entry)) {
+        return invalid('entry must be a plugin-relative .flow.ts path.');
+    }
+    const extension = extensionShape(value.extends);
+    if (!extension.handlers && extension.hooks.length === 0) {
+        return invalid('A flow extension must contribute handlers or at least one hook.');
+    }
+    for (let index = 0; index < 2; index += 1) {
+        const field = index === 0 ? 'verbs' : 'gates';
+        const at = value[field];
+        if (at !== undefined && (!ARRAY_IS_ARRAY(at) || at.length !== 0)) {
+            return invalid(`A flow extension declares no ${field}; ship a helper plugin beside it.`);
+        }
+    }
+    const preflight = preflightShape(value.preflight);
+    const output = OBJECT_CREATE(null);
+    output.schema = 2;
+    output.kind = 'flow-extension';
+    output.name = value.name;
+    output.version = value.version;
+    if (value.description !== undefined)
+        output.description = value.description;
+    output.compat = compatShape(value.compat);
+    output.entry = value.entry;
+    output.extends = extension;
+    output.triggers = triggerShapes(value.triggers ?? []);
+    output.permissions = permissionsShape(value.permissions);
+    output.preflight = preflight;
+    return frozenHostedPromiseValue(output);
+}
+function extensionShape(value) {
+    if (!record(value) || !hasOnlyKeys(value, ['handlers', 'hooks', 'verbs', 'gates'])
+        || typeof value.handlers !== 'boolean') {
+        return invalid('extends expects { handlers: boolean, hooks: [] }.');
+    }
+    for (let index = 0; index < 2; index += 1) {
+        const field = index === 0 ? 'verbs' : 'gates';
+        const at = value[field];
+        if (at !== undefined && (!ARRAY_IS_ARRAY(at) || at.length !== 0)) {
+            return invalid(`A flow extension declares no ${field}; ship a helper plugin beside it.`);
+        }
+    }
+    return OBJECT_FREEZE({ handlers: value.handlers, hooks: stringList(value.hooks ?? [], 'extends.hooks', NAME) });
+}
+function compatShape(value) {
+    if (!record(value) || !hasOnlyKeys(value, ['surface', 'sdk', 'base'])
+        || typeof value.surface !== 'string' || !matches(VERSION_RANGE, value.surface)
+        || typeof value.sdk !== 'string' || !matches(VERSION_RANGE, value.sdk)
+        || !ARRAY_IS_ARRAY(value.base) || value.base.length === 0 || value.base.length > MAX_LIST) {
+        return invalid('compat expects surface, sdk, and at least one base.');
+    }
+    const base = [];
+    for (let index = 0; index < value.base.length; index += 1) {
+        const entry = value.base[index];
+        if (!record(entry) || !hasOnlyKeys(entry, ['name', 'version'])
+            || typeof entry.name !== 'string' || STRING_TRIM(entry.name).length === 0 || entry.name.length > 100
+            || typeof entry.version !== 'string' || !matches(VERSION_RANGE, entry.version)) {
+            return invalid('compat.base entries are { name, version range }.');
+        }
+        for (let prior = 0; prior < base.length; prior += 1) {
+            if (base[prior].name === entry.name)
+                return invalid('compat.base names a base flow twice.');
+        }
+        appendIntrinsicArray(base, OBJECT_FREEZE({ name: entry.name, version: entry.version }));
+    }
+    return OBJECT_FREEZE({ surface: value.surface, sdk: value.sdk, base: OBJECT_FREEZE(base) });
+}
+function triggerShapes(value) {
+    if (!ARRAY_IS_ARRAY(value) || value.length > MAX_LIST)
+        return invalid('triggers must be a list.');
+    const output = [];
+    for (let index = 0; index < value.length; index += 1) {
+        const entry = value[index];
+        if (!record(entry) || !hasOnlyKeys(entry, ['provider', 'event', 'actions'])
+            || typeof entry.provider !== 'string' || !matches(PROVIDER, entry.provider)
+            || typeof entry.event !== 'string' || !matches(IDENTIFIER, entry.event)) {
+            return invalid('triggers entries are { provider, event, actions }.');
+        }
+        for (let prior = 0; prior < output.length; prior += 1) {
+            if (output[prior].provider === entry.provider && output[prior].event === entry.event) {
+                return invalid(`Trigger ${entry.provider}:${entry.event} is declared twice.`);
+            }
+        }
+        appendIntrinsicArray(output, OBJECT_FREEZE({
+            provider: entry.provider,
+            event: entry.event,
+            actions: stringList(entry.actions, `triggers ${entry.provider}.${entry.event} actions`, IDENTIFIER),
+        }));
+    }
+    return OBJECT_FREEZE(output);
+}
+function permissionsShape(value) {
+    if (!record(value) || !hasOnlyKeys(value, ['integrations', 'harnesses', 'mcp', 'writes', 'budget'])) {
+        return invalid('permissions expects integrations, harnesses, mcp, writes, and optional budget.');
+    }
+    let budget;
+    if (value.budget !== undefined) {
+        if (!record(value.budget) || !hasOnlyKeys(value.budget, ['dollars', 'wallclock'])) {
+            return invalid('permissions.budget expects dollars and/or wallclock.');
+        }
+        if (value.budget.dollars !== undefined
+            && (typeof value.budget.dollars !== 'number' || value.budget.dollars <= 0
+                || !NUMBER_IS_FINITE(value.budget.dollars))) {
+            return invalid('permissions.budget.dollars must be a positive number.');
+        }
+        if (value.budget.wallclock !== undefined
+            && (typeof value.budget.wallclock !== 'string' || !matches(WALLCLOCK, value.budget.wallclock))) {
+            return invalid('permissions.budget.wallclock must be a duration such as 45m.');
+        }
+        const projected = OBJECT_CREATE(null);
+        if (value.budget.dollars !== undefined)
+            projected.dollars = value.budget.dollars;
+        if (value.budget.wallclock !== undefined)
+            projected.wallclock = value.budget.wallclock;
+        budget = OBJECT_FREEZE(projected);
+    }
+    const output = OBJECT_CREATE(null);
+    output.integrations = stringList(value.integrations, 'permissions.integrations', PROVIDER);
+    output.harnesses = stringList(value.harnesses, 'permissions.harnesses', /^[a-z]+$/);
+    output.mcp = stringList(value.mcp, 'permissions.mcp', /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/);
+    output.writes = stringList(value.writes, 'permissions.writes', WRITE_CLASS);
+    if (budget !== undefined)
+        output.budget = budget;
+    return OBJECT_FREEZE(output);
+}
+function preflightShape(value) {
+    if (!record(value) || !hasOnlyKeys(value, ['credentials', 'servers'])) {
+        return invalid('Preflight requires credentials and servers arrays.');
+    }
+    const servers = stringList(value.servers, 'preflight.servers', /^https?:\/\/\S+$/);
+    return OBJECT_FREEZE({
+        credentials: stringList(value.credentials, 'preflight.credentials', IDENTIFIER),
+        servers,
+    });
+}
+function stringList(value, what, pattern) {
+    if (!ARRAY_IS_ARRAY(value) || value.length > MAX_LIST) {
+        return invalid(`${what} must be a list of at most ${MAX_LIST} strings.`);
+    }
+    const output = [];
+    for (let index = 0; index < value.length; index += 1) {
+        const entry = value[index];
+        if (typeof entry !== 'string' || !matches(pattern, entry))
+            return invalid(`${what} has an invalid entry.`);
+        for (let prior = 0; prior < output.length; prior += 1) {
+            if (output[prior] === entry)
+                return invalid(`${what} lists ${entry} twice.`);
+        }
+        appendIntrinsicArray(output, entry);
+    }
+    return OBJECT_FREEZE(output);
+}
+function record(value) {
+    return typeof value === 'object' && value !== null && !ARRAY_IS_ARRAY(value);
+}
+function hasOnlyKeys(value, allowed) {
+    const keys = OBJECT_KEYS(value);
+    for (let index = 0; index < keys.length; index += 1) {
+        let found = false;
+        for (let allowedIndex = 0; allowedIndex < allowed.length; allowedIndex += 1) {
+            if (keys[index] === allowed[allowedIndex]) {
+                found = true;
+                break;
+            }
+        }
+        if (!found)
+            return false;
+    }
+    return true;
+}
+function matches(pattern, value) {
+    return REGEXP_TEST(pattern, value);
+}
+function invalid(message) {
+    throw new PluginError('plugin_manifest_invalid', message);
+}
+//# sourceMappingURL=hosted-extension-manifest.js.map

package/dist/hosted-extension-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-extension-manifest.js","sourceRoot":"","sources":["../src/hosted-extension-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAOvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC;AACrC,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC;AACzC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;AACpC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;AACpC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;AACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;AAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAG1D,CAAC;AACb,MAAM,gBAAgB,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAGnE,CAAC;AACb,MAAM,kBAAkB,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAGvE,CAAC;AACb,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAA8B,CAAC;AAErG,MAAM,SAAS,GAAG;IAChB,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;IAC/E,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ;CACrE,CAAC;AACX,MAAM,IAAI,GAAG,4BAA4B,CAAC;AAC1C,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAC9C,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAC7C,MAAM,WAAW,GAAG,+BAA+B,CAAC;AACpD,MAAM,SAAS,GAAG,qBAAqB,CAAC;AACxC,MAAM,OAAO,GAAG,qCAAqC,CAAC;AACtD,MAAM,aAAa,GAAG,iGAAiG,CAAC;AACxH,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,KAAc;IAChE,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC;QAAE,OAAO,OAAO,CAAC,mDAAmD,CAAC,CAAC;IAC1H,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACtH,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9G,OAAO,OAAO,CAAC,oEAAoE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC3H,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;WAC9B,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,eAAe,CAAC,EAAE,CAAC;QAC3F,OAAO,OAAO,CAAC,2CAA2C,eAAe,cAAc,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,wEAAwE,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5G,OAAO,OAAO,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,OAAO,CAAC,iEAAiE,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,OAAO,CAAC,gCAAgC,KAAK,mCAAmC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAA4B,CAAC;IAC9D,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAClB,MAAM,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACzB,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/B,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAC5E,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC3B,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,MAAM,CAAC,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,OAAO,wBAAwB,CAAC,MAAM,CAAqC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;WAC7E,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,OAAO,CAAC,gCAAgC,KAAK,mCAAmC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;WAChE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC;WAC3E,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC;WACnE,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC5F,OAAO,OAAO,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAA+D,EAAE,CAAC;IAC5E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;eACzD,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG;eACjG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACjF,OAAO,OAAO,CAAC,kDAAkD,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,KAAK,CAAE,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;gBAAE,OAAO,OAAO,CAAC,sCAAsC,CAAC,CAAC;QAC/F,CAAC;QACD,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ;QAAE,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAClG,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;eACtE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;eACxE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1E,OAAO,OAAO,CAAC,oDAAoD,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,KAAK,CAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;gBACvF,OAAO,OAAO,CAAC,WAAW,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,qBAAqB,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC;YACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,UAAU,EAAE,UAAU,CAAC;SACpG,CAAC,CAAC,CAAC;IACN,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QACpG,OAAO,OAAO,CAAC,gFAAgF,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,MAA0C,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,OAAO,CAAC,sDAAsD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS;eACjC,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC;mBACpE,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC,uDAAuD,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;eACnC,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACjG,OAAO,OAAO,CAAC,8DAA8D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAA6C,CAAC;QAClF,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QACjF,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,SAAS,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;QACvF,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAA4B,CAAC;IAC9D,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,0BAA0B,EAAE,QAAQ,CAAC,CAAC;IAC3F,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,EAAE,UAAU,CAAC,CAAC;IACpF,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IAC3F,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACjD,OAAO,aAAa,CAAC,MAAM,CAAwC,CAAC;AACtE,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,OAAO,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;IACnF,OAAO,aAAa,CAAC;QACnB,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,uBAAuB,EAAE,UAAU,CAAC;QAC/E,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,IAAY,EAAE,OAAe;IAC/D,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC,GAAG,IAAI,8BAA8B,QAAQ,WAAW,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;QAC3G,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,OAAO,CAAC,GAAG,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC;QAC/E,CAAC;QACD,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,OAA0B;IAC7E,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,IAAI,YAAY,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,CAAC,EAAE,CAAC;YAC5E,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1C,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,KAAa;IAC7C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC"}

package/dist/hosted-extension-protocol.d.ts

@@ -0,0 +1,16 @@
+import { ChildProcess } from 'node:child_process';
+import { Readable, Writable } from 'node:stream';
+export interface HostedExtensionProtocolResult {
+    readonly completionReason: 'success';
+    readonly capabilityCalls: 1;
+}
+/** A bounded JSON copy, stripped of prototypes and behavior. */
+export declare function boundedJsonSnapshot(value: unknown, what: string): unknown;
+/**
+ * Exchange hostile child frames for one parent-owned capability invocation.
+ * Descriptor 3 is transport, never authority: every frame and both boundary
+ * payloads are validated by the parent. A child writing descriptor 3 directly
+ * can request only the same exact, single capability its context exposes.
+ */
+export declare function exchangeHostedExtension(child: ChildProcess, protocol: Readable, stdin: Writable, stderr: Readable, timeoutMs: number, request: unknown, invoke: (request: unknown) => Promise<unknown>): Promise<HostedExtensionProtocolResult>;
+//# sourceMappingURL=hosted-extension-protocol.d.ts.map

package/dist/hosted-extension-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-extension-protocol.d.ts","sourceRoot":"","sources":["../src/hosted-extension-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAoEjD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC;CAC7B;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAWzE;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,QAAQ,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAC7C,OAAO,CAAC,6BAA6B,CAAC,CAyIxC"}